I would like to know how this is working and, what are the technique to prevent an UPX packed executable to be decompressed through
upx -d (if possible for, both, Linux and Windows).
- Anybody can ask a question
- Anybody can answer
- The best answers are voted up and rise to the top
UPX doesn't check the unpacking stub's integrity, and just blindly restores the data from the stored information, not from the actual execution.
Since UPX is open-source and documented (commented IDB), it's easy to modify its and actually do something extra (anti-debug, patch, decryption, jump to real entrypoint...) that will be lost when 'upx -d' is used.
Such UPX hack is not uncommon in malware.
Pack the MS-Windows standard